@volter/twin-stripe 3.0.0 → 3.0.1

package/dist/src/screens/billing-portal.js

@@ -3,7 +3,7 @@ import { flowPage, Portal, PORTAL_CSS } from '@volter/world-ui';
 import { publicBusinessName } from "../engine/display.js";
 import { declineFor, nowUnix, paymentMethodSubObject, PLATFORM_ACCOUNT_ID } from "../engine/stripe.js";
 import { cardAnswer, COUNTRIES, formOf, money, notFound } from "./shared.js";
-import { afterSuccessOf, created, payerOf, payOpenInvoice } from "../semantics/shared.js";
+import { resourceView, afterSuccessOf, created, payerOf, payOpenInvoice } from "../semantics/shared.js";
 const SUB = 'subscription';
 const PORTAL_OPERATION = { id: 'PostBillingPortalSessions' };
 // Stripe's skin: its type, its purple accent, the merchant's side tinted.
@@ -46,7 +46,7 @@ function planOf(ctx, sub) {
 function page(ctx, id, session, problem) {
     const features = featuresOf(ctx, session);
     const customer = ctx.get('customer', String(session.customer)) ?? {};
-    const subs = ctx.rows(SUB).filter((s) => s.customer === session.customer && s.status !== 'canceled' && s.status !== 'incomplete_expired');
+    const subs = ctx.rows(SUB).map((s) => ctx.expand(SUB, s)).filter((s) => s.customer === session.customer && s.status !== 'canceled' && s.status !== 'incomplete_expired');
     const plans = subs.map((s) => {
         const plan = planOf(ctx, s);
         const ending = s.cancel_at_period_end === true;
@@ -105,7 +105,7 @@ function page(ctx, id, session, problem) {
 }
 /** The customer's move on one of their subscriptions, then back to the portal. */
 async function move(ctx, id, session, subscription, kind) {
-    const sub = ctx.get(SUB, subscription);
+    const sub = resourceView(ctx, SUB, subscription);
     if (!sub || sub.customer !== session.customer || sub.status === 'canceled')
         return gone();
     const back = new Response(null, { status: 303, headers: { location: `/p/session/${id}` } });
@@ -146,7 +146,7 @@ async function updatePaymentMethod(ctx, id, session, v) {
     });
     const holder = ctx.get('customer', customer) ?? {};
     await ctx.write('customer', customer, { invoice_settings: { ...(holder.invoice_settings ?? {}), default_payment_method: pm.id } }, 'customer.update');
-    for (const sub of ctx.rows(SUB).filter((s) => s.customer === customer && s.status !== 'canceled' && s.status !== 'incomplete_expired')) {
+    for (const sub of ctx.rows(SUB).map((s) => ctx.expand(SUB, s)).filter((s) => s.customer === customer && s.status !== 'canceled' && s.status !== 'incomplete_expired')) {
         await ctx.write(SUB, String(sub.id), { default_payment_method: pm.id }, 'subscription.update');
     }
     return new Response(null, { status: 303, headers: { location: `/p/session/${id}` } });
@@ -156,7 +156,7 @@ async function payInvoice(ctx, id, session, invoiceId) {
     const inv = ctx.get('invoice', invoiceId);
     if (!inv || inv.customer !== session.customer || inv.status !== 'open')
         return gone();
-    const sub = typeof inv.subscription === 'string' ? ctx.get(SUB, inv.subscription) : undefined;
+    const sub = typeof inv.subscription === 'string' ? resourceView(ctx, SUB, inv.subscription) : undefined;
     const holder = ctx.get('customer', String(session.customer)) ?? {};
     const pm = (sub ? payerOf(ctx, sub) : undefined) ?? holder.invoice_settings?.default_payment_method;
     if (!pm)

package/dist/src/screens/{connect-oauth.d.ts → checkout-js.d.ts}

@@ -1,3 +1,2 @@
 import type { HandlerContext } from '@volter/world-core';
-/** connect.stripe.com's OAuth endpoints; Stripe's 404 for anything else there. */
 export declare function screen(ctx: HandlerContext): Promise<Response>;

package/dist/src/screens/checkout-js.js

@@ -0,0 +1,84 @@
+import { newCustomer } from "../engine/customers.js";
+import { CS } from "../engine/checkout.js";
+import { applyCouponDiscount, nowUnix, resolveTrial } from "../engine/stripe.js";
+import { cardAnswer, parseExpiry } from "./shared.js";
+import { completeSession, discountOf, created } from "../semantics/shared.js";
+function amount(value, currency) {
+    return { amount: new Intl.NumberFormat('en-US', { style: 'currency', currency }).format(value / 100), minorUnitsAmount: value };
+}
+// source: archive:https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-8.6.0.tgz#sha256=13e61419e9076ab440cc636e34d3ea5df3fc62bbf2d6a80d3fd718e8cd47f0a2!/package/dist/stripe-js/checkout.d.ts "export interface StripeCheckoutSession"
+// The SDK publishes its contract, not its private HTTP wire. This authored payment_pages wire uses the same session store and completion as hosted Checkout.
+function view(ctx, session) {
+    const currency = String(session.currency ?? 'usd');
+    const lines = (session.line_items?.data ?? []);
+    const stored = ctx.row(CS, String(session.id)) ?? session;
+    const trial = session.mode === 'subscription' ? resolveTrial(stored._subscription_data ?? {}, nowUnix(ctx.occurredAt)) : undefined;
+    const customer = typeof session.customer === 'string' ? ctx.get('customer', session.customer) : undefined;
+    const discount = stored._discount;
+    const promotion = typeof discount?.promotion_code === 'string' ? ctx.get('promotion_code', discount.promotion_code) : undefined;
+    const zero = amount(0, currency);
+    return {
+        id: session.id, billingAddress: null, businessName: null, canConfirm: session.status === 'open', currency,
+        currencyOptions: null, discountAmounts: promotion ? [{ ...amount(Number(session.total_details?.amount_discount ?? 0), currency), promotionCode: promotion.code }] : [],
+        email: customer?.email ?? session.customer_email ?? null, lastPaymentError: null,
+        lineItems: lines.map(line => ({ id: line.id, name: line.description, quantity: line.quantity, unitAmount: amount(Number(line.amount_subtotal) / Number(line.quantity || 1), currency), total: amount(Number(line.amount_total), currency) })),
+        livemode: false, minorUnitsAmountDivisor: 100, phoneNumber: null,
+        recurring: session.mode === 'subscription' ? { trial: trial ? { trialEnd: trial.end, trialPeriodDays: Math.ceil((trial.end - trial.start) / 86400) } : null } : null,
+        savedPaymentMethods: [], shipping: null, shippingAddress: null, shippingOptions: [],
+        status: session.status === 'complete' ? { type: 'complete', paymentStatus: session.payment_status } : { type: session.status },
+        tax: { status: 'ready' }, taxAmounts: [], taxIdInfo: null,
+        total: { appliedBalance: zero, balanceAppliedToNextInvoice: false, discount: amount(Number(session.total_details?.amount_discount ?? 0), currency), shippingRate: zero, subtotal: amount(Number(session.amount_subtotal ?? 0), currency), taxExclusive: zero, taxInclusive: zero, total: amount(trial ? 0 : Number(session.amount_total ?? 0), currency) },
+    };
+}
+const failed = (message, code = null) => Response.json({ type: 'error', error: { message, code } });
+export async function screen(ctx) {
+    const path = new URL(ctx.call.request.url).pathname;
+    const id = path.split('/')[3];
+    const action = path.split('/')[4];
+    const params = ctx.params;
+    const session = ctx.get(CS, id);
+    // The private client secret is the browser's authority for this session; it never accepts a secret API key.
+    if (!session || session.ui_mode !== 'custom' || params.client_secret !== session.client_secret)
+        return failed('Invalid Checkout Session client secret.');
+    if (action === 'init')
+        return Response.json({ type: 'success', session: view(ctx, session) });
+    if (session.status !== 'open')
+        return failed('This Checkout Session is no longer active.');
+    if (action === 'apply_promotion_code' || action === 'remove_promotion_code') {
+        if (action === 'apply_promotion_code' && session.allow_promotion_codes !== true)
+            return failed('Promotion codes are not enabled for this Checkout Session.');
+        const promotion = action === 'apply_promotion_code' ? ctx.rows('promotion_code').find(p => p.code === params.promotion_code && p.active === true) : undefined;
+        if (action === 'apply_promotion_code' && !promotion)
+            return failed('This promotion code is invalid.', 'invalidPromotionCode');
+        const discount = promotion ? discountOf(ctx, { discounts: [{ promotion_code: promotion.id }] }, nowUnix(ctx.occurredAt)) : undefined;
+        if (discount instanceof Response)
+            return failed('This promotion code is invalid.', 'invalidPromotionCode');
+        const off = discount ? applyCouponDiscount(Number(session.amount_subtotal), discount.coupon) : 0;
+        const fields = { amount_total: Number(session.amount_subtotal) - off, total_details: { ...session.total_details, amount_discount: off }, discounts: discount ? [{ coupon: discount.coupon.id, promotion_code: promotion.id }] : [], _discount: discount ? { coupon: discount.coupon.id, promotion_code: promotion.id } : null };
+        const updated = await ctx.write(CS, id, fields, 'checkout.session.update');
+        return Response.json({ type: 'success', session: view(ctx, updated) });
+    }
+    if (action !== 'confirm')
+        return failed('Unrecognized Checkout action.');
+    const values = (params.payment_details ?? {});
+    const stored = ctx.row(CS, id) ?? session;
+    const trial = session.mode === 'subscription' ? resolveTrial(stored._subscription_data ?? {}, nowUnix(ctx.occurredAt)) : undefined;
+    const refusal = cardAnswer(values, nowUnix(ctx.occurredAt), !trial);
+    if (refusal)
+        return failed(refusal, 'paymentFailed');
+    const customer = typeof session.customer === 'string' ? ctx.get('customer', session.customer) : undefined;
+    const email = String(customer?.email ?? params.email ?? session.customer_email ?? '');
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
+        return failed('Your email address is incomplete.');
+    let existing = session;
+    if (!customer && session.mode === 'subscription') {
+        const cid = ctx.mint('customer');
+        const made = await created(ctx, 'customer', { id: cid, email }, { livemode: false, ...newCustomer(cid) });
+        existing = { ...session, customer: made.id };
+    }
+    const expiry = parseExpiry(values.cardExpiry);
+    const completed = await completeSession(ctx, id, existing, { customer: existing.customer, customer_details: { email, name: values.billingName ?? null, address: null, phone: null, tax_exempt: 'none', tax_ids: [] } }, { number: values.cardNumber.replace(/\D/g, ''), exp_month: expiry.month, exp_year: expiry.year });
+    if (completed instanceof Response)
+        return failed('This Checkout Session is no longer active.');
+    return Response.json({ type: 'success', session: view(ctx, completed), return_url: session.return_url });
+}

package/dist/src/screens/connect-onboarding.js

@@ -6,7 +6,6 @@ import { INDUSTRIES as MCCS } from "../engine/industries.js";
 import { currentlyDue, kindOf, OFFERED } from "../engine/onboarding.js";
 import { created, syncExternals } from "../semantics/shared.js";
 const LINK = 'account_link';
-const OPERATION = { id: 'PostAccountsAccount' };
 const gone = () => flowPage({ title: 'Stripe', status: 404, css: [CONSENT_CSS, STRIPE_CONSENT_SKIN], body: _jsx("main", { className: "consent", children: _jsx("h1", { className: "consent-heading", children: "This link is invalid." }) }) });
 /** A link that can still be used: not used and not past its expiry. */
 const usable = (ctx, link) => link.used !== true && Number(link.expires_at) > nowUnix(ctx.occurredAt);
@@ -81,7 +80,7 @@ async function submit(ctx, link, kind, v, ip) {
         return;
     const caps = { ...(account.capabilities ?? {}) };
     for (const [cap, status] of Object.entries(caps)) {
-        if (status !== 'active' && !ctx.legal('capability', 'status', OPERATION.id, String(status), 'active', cap, 'vendor'))
+        if (status !== 'active')
             caps[cap] = 'active';
     }
     const due = currentlyDue(kind, v);
@@ -91,6 +90,7 @@ async function submit(ctx, link, kind, v, ip) {
     const person = { first_name: v.first_name, last_name: v.last_name, email: v.email, phone: v.phone, dob: { day, month, year }, address: addressOf(''), ssn_last_4_provided: true, id_number_provided: false };
     const company = kind === 'company';
     const settings = account.settings ?? {};
+    const individual = company ? null : await created(ctx, 'person', { ...person, account: id }, { relationship: { representative: true }, metadata: {} });
     await ctx.write('account', id, {
         details_submitted: true, charges_enabled: due.length === 0, payouts_enabled: due.length === 0, capabilities: caps, requirements,
         business_type: kind,
@@ -98,7 +98,7 @@ async function submit(ctx, link, kind, v, ip) {
         settings: { ...settings, payments: { ...(settings.payments ?? {}), statement_descriptor: v.statement_descriptor } },
         ...(company
             ? { company: { name: v.company_name, phone: v.company_phone, address: addressOf('company_'), tax_id_provided: true, owners_provided: true, directors_provided: false, executives_provided: false } }
-            : { individual: { ...person, id: `person_${id}` } }),
+            : { individual: individual.id }),
         tos_acceptance: { date: nowUnix(ctx.occurredAt), ip, user_agent: null },
     }, 'account.updated');
     if (company) {

package/dist/src/screens/dashboard.d.ts

@@ -1,3 +1,3 @@
 import type { HandlerContext } from '@volter/world-core';
-/** dashboard.stripe.com's pages: Public details and the Connect OAuth settings; Stripe's 404 for any other. */
+/** Dashboard settings, Radar list creation and test Issuing funding; other pages answer Stripe's 404. */
 export declare function screen(ctx: HandlerContext): Promise<Response>;

package/dist/src/screens/dashboard.js

@@ -1,42 +1,16 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { flowPage } from '@volter/world-ui';
+import { VL } from "../engine/radar.js";
+import { nowUnix } from "../engine/stripe.js";
 import { platformAccountDefault } from "../engine/connect.js";
-import { CONNECT_SETTINGS_PATH, PLATFORM_CLIENT_ID, redirectUris, SETTINGS } from "../engine/connect-settings.js";
 import { publicBusinessName } from "../engine/display.js";
 import { PLATFORM_ACCOUNT_ID } from "../engine/stripe.js";
 import { formOf, notFound } from "./shared.js";
-import { connectOAuthSettings, created } from "../semantics/shared.js";
+import { created } from "../semantics/shared.js";
+const redirect = (path) => new Response(null, { status: 303, headers: { location: path } });
+const invalid = (message) => flowPage({ css: [], title: 'Stripe', status: 400, body: _jsx("main", { children: _jsx("p", { role: "alert", children: message }) }) });
 const PUBLIC_DETAILS_PATH = '/settings/public';
 const MAX_NAME = 5000;
-const SETTINGS_CSS = `
-* { box-sizing: border-box; }
-body { margin: 0; background: #f6f8fa; color: #1a1f36; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Ubuntu, sans-serif; font-size: 14px; }
-.co { max-width: 680px; margin: 48px auto; padding: 0 16px; }
-.co h1 { font-size: 28px; margin: 16px 0 4px; }
-.co-lead { color: #697386; margin: 0 0 24px; }
-.co-card { background: #ffffff; border: 1px solid #e3e8ee; border-radius: 8px; padding: 24px; margin-bottom: 16px; }
-.co-card h2 { font-size: 16px; margin: 0 0 12px; }
-.co-card label { display: block; font-weight: 600; margin-bottom: 6px; }
-.co-card small { display: block; color: #697386; margin-bottom: 8px; }
-.co-card textarea { width: 100%; min-height: 96px; padding: 8px 10px; border: 1px solid #c1c9d2; border-radius: 6px; font: 13px ui-monospace, Menlo, monospace; }
-.co-id { font: 14px ui-monospace, Menlo, monospace; background: #f6f8fa; border: 1px solid #e3e8ee; border-radius: 6px; padding: 6px 10px; display: inline-block; }
-.co-toggle { display: flex; gap: 8px; align-items: center; font-weight: 600; }
-.co-actions { display: flex; justify-content: flex-end; }
-.co-actions button { background: #635bff; color: #ffffff; border: 0; border-radius: 6px; padding: 8px 16px; font: inherit; font-weight: 600; cursor: pointer; }
-.co-notice { padding: 10px 12px; border-radius: 6px; margin-bottom: 16px; }
-.co-error { background: #fff0f3; color: #df1b41; }
-.co-saved { background: #e7f8ef; color: #0e6245; }
-.co-uris { margin: 0; padding-left: 18px; }
-`;
-function settingsPage(s, opts = {}) {
-    const enabled = opts.enabled ?? s.oauth_enabled;
-    return flowPage({
-        title: 'OAuth – Connect settings – Stripe',
-        css: [SETTINGS_CSS],
-        ...(opts.error ? { status: 400 } : {}),
-        body: (_jsxs("main", { className: "co", children: [_jsx("h1", { children: "OAuth" }), _jsx("p", { className: "co-lead", children: "Onboard Standard accounts by sending them to Stripe's OAuth flow. Test mode." }), opts.error ? _jsx("p", { className: "co-notice co-error", role: "alert", children: opts.error }) : null, opts.saved ? _jsx("p", { className: "co-notice co-saved", role: "status", children: "Your OAuth settings were saved." }) : null, _jsxs("section", { className: "co-card", children: [_jsx("h2", { children: "Test mode client ID" }), _jsx("small", { children: "The client_id your platform sends to connect.stripe.com/oauth/authorize." }), _jsx("code", { className: "co-id", "data-testid": "connect-client-id", children: PLATFORM_CLIENT_ID }), _jsx("p", { "data-testid": "connect-oauth-status", children: s.oauth_enabled ? 'OAuth is enabled.' : 'OAuth is disabled.' }), s.redirect_uris.length ? _jsx("ul", { className: "co-uris", children: s.redirect_uris.map((u) => _jsx("li", { "data-testid": "connect-redirect-uri", children: u }, u)) }) : _jsx("p", { children: "No redirect URIs." })] }), _jsxs("form", { className: "co-card", method: "post", children: [_jsxs("label", { className: "co-toggle", htmlFor: "oauth_enabled", children: [_jsx("input", { type: "checkbox", id: "oauth_enabled", name: "oauth_enabled", value: "on", defaultChecked: enabled }), " Enable OAuth for Standard accounts"] }), _jsx("label", { htmlFor: "redirect_uris", children: "Redirect URIs" }), _jsx("small", { children: "One per line. The first is used when a request names none. http and localhost are allowed in test mode." }), _jsx("textarea", { id: "redirect_uris", name: "redirect_uris", defaultValue: opts.value ?? s.redirect_uris.join('\n') }), _jsx("div", { className: "co-actions", children: _jsx("button", { type: "submit", children: "Save" }) })] })] })),
-    });
-}
 const DETAILS_CSS = `
 * { box-sizing: border-box; }
 body { margin: 0; background: #f6f8fa; color: #1a1f36; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Ubuntu, sans-serif; font-size: 14px; }
@@ -74,22 +48,6 @@ async function save(ctx, name) {
 function nameRefused(name) {
     return !name ? 'Enter your business name.' : name.length > MAX_NAME ? `Your business name must be at most ${MAX_NAME} characters.` : undefined;
 }
-async function settings(ctx) {
-    const request = ctx.call.request;
-    const url = new URL(request.url);
-    if (request.method !== 'GET' && request.method !== 'POST')
-        return notFound();
-    const form = request.method === 'POST' ? await formOf(request.clone()) : {};
-    const held = connectOAuthSettings(ctx);
-    if (request.method === 'GET')
-        return settingsPage(held, { saved: url.searchParams.has('saved') });
-    const enabled = form.oauth_enabled === 'on' || form.oauth_enabled === 'true';
-    const parsed = redirectUris(form.redirect_uris ?? '');
-    if ('refused' in parsed)
-        return settingsPage(held, { value: form.redirect_uris ?? '', enabled, error: parsed.refused });
-    await ctx.record(SETTINGS, { oauth_enabled: enabled, redirect_uris: parsed.uris }, PLATFORM_CLIENT_ID);
-    return new Response(null, { status: 303, headers: { location: '?saved=1' } });
-}
 async function publicDetails(ctx) {
     const request = ctx.call.request;
     const url = new URL(request.url);
@@ -106,12 +64,53 @@ async function publicDetails(ctx) {
     // a query-only reference: the page's own path, wherever it is mounted and with or without its trailing slash
     return new Response(null, { status: 303, headers: { location: '?saved=1' } });
 }
-/** dashboard.stripe.com's pages: Public details and the Connect OAuth settings; Stripe's 404 for any other. */
+/** Dashboard settings, Radar list creation and test Issuing funding; other pages answer Stripe's 404. */
 export async function screen(ctx) {
     const path = new URL(ctx.call.request.url).pathname.replace(/\/+$/, '');
-    if (path === PUBLIC_DETAILS_PATH)
-        return publicDetails(ctx);
-    if (CONNECT_SETTINGS_PATH.test(path))
-        return settings(ctx);
-    return notFound();
+    // source: https://docs.stripe.com/radar/lists "Use the Dashboard or the API to create lists."
+    // source: https://docs.stripe.com/radar/lists "Enter a name for the list"
+    // source: https://docs.stripe.com/radar/lists "Select the type of list to create."
+    // source: https://docs.stripe.com/radar/lists "Click Add to save your new list."
+    // Where the documentation stops: it names Dashboard controls, not their browser request routes or form wire.
+    // This authored page uses /radar/lists for GET and POST, /radar/lists/{id} for its redirect/detail address,
+    // and a 303 redirect after saving. The HTML field names name, alias and item_type are the twin's choices;
+    // item_type values are the pinned API's enums, not published Dashboard form values. The alias fallback's
+    // lowercase/underscore algorithm is also authored; Stripe says it generates an alias but gives no algorithm.
+    if (/^\/radar\/lists(?:\/[^/]+)?$/.test(path)) {
+        if (ctx.call.request.method === 'POST') {
+            const form = await formOf(ctx.call.request);
+            const types = ['string', 'case_sensitive_string', 'card_fingerprint', 'card_bin', 'customer_id', 'email', 'ip_address', 'country', 'sepa_debit_fingerprint', 'us_bank_account_fingerprint'];
+            if (!form.name?.trim() || !types.includes(form.item_type ?? ''))
+                return invalid('Enter a name and select a list type.');
+            const alias = form.alias?.trim() || form.name.toLowerCase().replace(/[^a-z0-9]+/g, '_');
+            // Where the page stops: an operator has no login identity in the World; created_by is its synthetic operator.
+            const list = await created(ctx, VL, { name: form.name.trim(), alias, item_type: form.item_type }, {
+                created_by: 'twin', livemode: false, metadata: {},
+                list_items: { object: 'list', data: [], has_more: false, url: '/v1/radar/value_list_items' },
+            });
+            await ctx.write(VL, String(list.id), { list_items: { object: 'list', data: [], has_more: false, url: `/v1/radar/value_list_items?value_list=${list.id}` } }, 'radar.value_list.updated');
+            return redirect(`/radar/lists/${list.id}`);
+        }
+        return flowPage({ css: [], title: 'Lists – Radar – Stripe', body: _jsxs("main", { children: [_jsx("h1", { children: "Radar Lists" }), _jsxs("form", { method: "post", action: "/radar/lists", children: [_jsx("h2", { children: "New list" }), _jsxs("label", { children: ["Name", _jsx("input", { name: "name", required: true })] }), _jsxs("label", { children: ["Alias", _jsx("input", { name: "alias" })] }), _jsxs("label", { children: ["List type", _jsxs("select", { name: "item_type", children: [_jsx("option", { value: "customer_id", children: "Customer ID" }), _jsx("option", { value: "email", children: "Email" }), _jsx("option", { value: "card_fingerprint", children: "Card fingerprint" }), _jsx("option", { value: "ip_address", children: "IP address" }), _jsx("option", { value: "string", children: "String" })] })] }), _jsx("button", { children: "Add" })] }), _jsx("ul", { children: ctx.rows(VL).map(row => _jsxs("li", { children: [String(row.name), " (", String(row.alias), ")"] }, String(row.id))) })] }) });
+    }
+    // source: https://docs.stripe.com/issuing/testing "Before you create test transactions, you must add test funds to the Issuing balance on your account."
+    // source: https://docs.stripe.com/issuing/testing "You can create test top-ups in the Dashboard, or with the Top-ups API"
+    // Where the documentation stops: it states the Dashboard funding act, not a browser request path or form wire.
+    // The authored GET/POST address and 303 redirect are /test/issuing/balance. The form name amount, its positive
+    // integer validation and its units (USD cents for this US sandbox) are the twin's choices, not published form
+    // fields. Its POST records the balance change in the vendor ledger, with source=null (permitted by the pinned
+    // schema) and immediate availability for this sandbox control; the page states neither that source nor timing.
+    // No private Topup object is seeded or answered, and the uncalled Top-ups API remains the gap.
+    if (path === '/test/issuing/balance') {
+        if (ctx.call.request.method === 'POST') {
+            const form = await formOf(ctx.call.request);
+            const amount = Number(form.amount);
+            if (!Number.isInteger(amount) || amount <= 0)
+                return invalid('Enter a positive amount in cents.');
+            await created(ctx, 'balance_transaction', {}, { amount, currency: 'usd', fee: 0, net: amount, type: 'topup', reporting_category: 'topup', source: null, status: 'available', balance_type: 'issuing', available_on: Number(nowUnix(ctx.occurredAt)), fee_details: [] });
+            return redirect('/test/issuing/balance');
+        }
+        return flowPage({ css: [], title: 'Test Issuing balance – Stripe', body: _jsxs("main", { children: [_jsx("h1", { children: "Test Issuing balance" }), _jsxs("form", { method: "post", children: [_jsxs("label", { children: ["Amount", _jsx("input", { name: "amount", type: "number", min: "1", required: true })] }), _jsx("button", { children: "Add test funds" })] })] }) });
+    }
+    return path === PUBLIC_DETAILS_PATH ? publicDetails(ctx) : notFound();
 }

package/dist/src/screens/stripe-js.js

@@ -1,115 +1,75 @@
 import { notFound } from "./shared.js";
 /** The release train a script path names: `/v3`, `/v3/` or `/v3/stripe.js` → 3, `/<train>/stripe.js` → the train. */
 function stripeJsTrain(pathname) {
-    if (/^\/v3(\/|\/stripe\.js)?$/.test(pathname))
-        return 3;
-    return /^\/([a-z]+)\/stripe\.js$/.exec(pathname)?.[1];
+    return /^\/v3(\/|\/stripe\.js)?$/.test(pathname) ? 3 : /^\/([a-z]+)\/stripe\.js$/.exec(pathname)?.[1];
 }
+// source: archive:https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-8.6.0.tgz#sha256=13e61419e9076ab440cc636e34d3ea5df3fc62bbf2d6a80d3fd718e8cd47f0a2!/package/dist/stripe-js/checkout.d.ts "loadActions: () => Promise<StripeCheckoutLoadActionsResult>"
 function script(version) {
     return `(function () {
   var version = ${JSON.stringify(version)};
   function gap(name) {
     return function () { throw new Error("Stripe.js (Volter twin): stripe." + name + " is not modelled by this twin yet"); };
   }
-  function Stripe(publishableKey) {
-    if (typeof publishableKey !== "string" || !publishableKey) throw new Error("Stripe.js (Volter twin): Stripe() needs a publishable key");
-    var api = "https://api.stripe.com/v1";
-    // the card fields every mounted element holds, the last mounted first
-    var mounted = [];
-    function cardOf(elements) {
-      var el = (elements && elements._mounted && elements._mounted[elements._mounted.length - 1]) || mounted[mounted.length - 1];
-      if (!el) return null;
-      var exp = String(el.expiry.value || "").split("/");
-      return { number: String(el.number.value || "").replace(/\s+/g, ""), exp_month: exp[0] ? String(Number(exp[0])) : "", exp_year: exp[1] ? String(2000 + Number(exp[1]) % 100) : "", cvc: String(el.cvc.value || "") };
-    }
-    function form(fields) {
-      return Object.keys(fields).filter(function (k) { return fields[k] !== undefined && fields[k] !== ""; }).map(function (k) { return encodeURIComponent(k) + "=" + encodeURIComponent(fields[k]); }).join("&");
-    }
-    function confirm(kind, options) {
-      options = options || {};
-      var elements = options.elements;
-      var secret = options.clientSecret || (elements && elements._options && elements._options.clientSecret);
-      if (typeof secret !== "string" || secret.indexOf("_secret_") < 0) return Promise.resolve({ error: { type: "invalid_request_error", message: "A clientSecret is required." } });
+  function initCheckout(options) {
+    var session, root, fields = {}, listeners = {};
+    function emit(name, value) { (listeners[name] || []).forEach(function (fn) { fn(value); }); }
+    function call(action, values) {
+      var secret = options.clientSecret;
       var id = secret.split("_secret_")[0];
-      var card = cardOf(elements);
-      var params = options.confirmParams || {};
-      var fields = { client_secret: secret };
-      if (card) { fields["payment_method_data[type]"] = "card"; fields["payment_method_data[card][number]"] = card.number; fields["payment_method_data[card][exp_month]"] = card.exp_month; fields["payment_method_data[card][exp_year]"] = card.exp_year; fields["payment_method_data[card][cvc]"] = card.cvc; }
-      if (params.return_url) fields.return_url = params.return_url;
-      var path = kind === "payment" ? "/payment_intents/" : "/setup_intents/";
-      return fetch(api + path + encodeURIComponent(id) + "/confirm", { method: "POST", headers: { authorization: "Bearer " + publishableKey, "content-type": "application/x-www-form-urlencoded" }, body: form(fields) })
-        .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })
-        .then(function (r) {
-          if (!r.ok) return { error: r.body.error || { type: "api_error", message: "The confirmation failed." } };
-          var key = kind === "payment" ? "paymentIntent" : "setupIntent";
-          var out = {}; out[key] = r.body;
-          if (options.redirect === "if_required" || !params.return_url) return out;
-          var q = kind === "payment" ? "payment_intent" : "setup_intent";
-          var target = new URL(params.return_url);
-          target.searchParams.set(q, r.body.id);
-          target.searchParams.set(q + "_client_secret", secret);
-          target.searchParams.set("redirect_status", r.body.status === "succeeded" ? "succeeded" : r.body.status === "processing" ? "processing" : "failed");
-          window.location.assign(target.toString());
-          return new Promise(function () {});
-        });
+      return fetch("https://api.stripe.com/v1/payment_pages/" + encodeURIComponent(id) + "/" + action, {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify(Object.assign({ client_secret: secret }, values || {}))
+      }).then(function (r) { return r.json(); }).then(function (result) {
+        if (result.type === "success") { session = result.session; emit("change", session); }
+        return result;
+      });
     }
-    function element(type, group) {
-      var handlers = {};
-      function emit(name, event) { (handlers[name] || []).forEach(function (h) { h(event); }); }
-      var el = {
-        _type: type,
-        mount: function (target) {
-          var node = typeof target === "string" ? document.querySelector(target) : target;
-          if (!node) throw new Error("Stripe.js (Volter twin): mount() found no element " + String(target));
-          node.innerHTML = "";
-          var wrap = document.createElement("div");
-          wrap.setAttribute("data-volter-twin-element", type);
-          function input(name, placeholder) { var i = document.createElement("input"); i.name = name; i.placeholder = placeholder; i.autocomplete = "off"; i.addEventListener("input", change); wrap.appendChild(i); return i; }
-          el.number = input("cardnumber", "Card number");
-          el.expiry = input("exp-date", "MM / YY");
-          el.cvc = input("cvc", "CVC");
-          node.appendChild(wrap);
-          mounted.push(el); group._mounted.push(el);
-          setTimeout(function () { emit("ready", { elementType: type }); }, 0);
-        },
-        on: function (name, handler) { (handlers[name] = handlers[name] || []).push(handler); return el; },
-        off: function (name, handler) { handlers[name] = (handlers[name] || []).filter(function (h) { return h !== handler; }); return el; },
-        update: function () {}, focus: function () { if (el.number) el.number.focus(); }, blur: function () {},
-        clear: function () { [el.number, el.expiry, el.cvc].forEach(function (i) { if (i) i.value = ""; }); change(); },
-        unmount: function () {}, destroy: function () { mounted = mounted.filter(function (m) { return m !== el; }); }
-      };
-      function change() {
-        var c = { number: el.number && el.number.value, expiry: el.expiry && el.expiry.value, cvc: el.cvc && el.cvc.value };
-        emit("change", { elementType: type, empty: !c.number && !c.expiry && !c.cvc, complete: !!(c.number && c.expiry && c.cvc), value: { type: "card" } });
+    var actions = {
+      getSession: function () { return session; },
+      applyPromotionCode: function (code) { return call("apply_promotion_code", { promotion_code: code }); },
+      removePromotionCode: function () { return call("remove_promotion_code"); },
+      confirm: function (params) {
+        return call("confirm", Object.assign({}, params || {}, { payment_details: fields })).then(function (result) {
+          if (result.type === "success" && (!params || params.redirect !== "if_required") && result.return_url) window.location.assign((params && params.returnUrl) || result.return_url);
+          return result;
+        });
       }
-      return el;
-    }
+    };
+    var elementListeners = {};
+    function elementEmit(name, value) { (elementListeners[name] || []).forEach(function (fn) { fn(value); }); }
+    var element = {
+      on: function (name, fn) { (elementListeners[name] || (elementListeners[name] = [])).push(fn); return element; },
+      off: function (name, fn) { elementListeners[name] = (elementListeners[name] || []).filter(function (f) { return f !== fn; }); return element; },
+      mount: function (target) {
+        root = typeof target === "string" ? document.querySelector(target) : target;
+        [["cardNumber", "Card number", "cc-number"], ["cardExpiry", "Expiration", "cc-exp"], ["cardCvc", "CVC", "cc-csc"], ["billingName", "Cardholder name", "cc-name"]].forEach(function (field) {
+          var label = document.createElement("label"), input = document.createElement("input");
+          label.textContent = field[1]; input.name = field[0]; input.autocomplete = field[2];
+          input.addEventListener("input", function () { fields[field[0]] = input.value; elementEmit("change", { empty: !fields.cardNumber, complete: !!(fields.cardNumber && fields.cardExpiry && fields.cardCvc), value: { type: "card" } }); });
+          label.appendChild(input); root.appendChild(label);
+        });
+        Promise.resolve().then(function () { elementEmit("ready", element); });
+      },
+      unmount: function () { if (root) root.replaceChildren(); root = null; },
+      destroy: function () { element.unmount(); elementListeners = {}; },
+      update: function () {}
+    };
+    return {
+      on: function (name, fn) { (listeners[name] || (listeners[name] = [])).push(fn); },
+      loadActions: function () { return call("init").then(function (r) { return r.type === "success" ? { type: "success", actions: actions } : r; }); },
+      createPaymentElement: function () { return element; }, getPaymentElement: function () { return element; },
+      changeAppearance: function () {}, loadFonts: function () {}
+    };
+  }
+  function Stripe(publishableKey) {
+    if (typeof publishableKey !== "string" || !publishableKey) throw new Error("Stripe.js (Volter twin): Stripe() needs a publishable key");
     var known = {
+      initCheckout: initCheckout,
       _registerWrapper: function () {},
-      elements: function (options) {
-        var group = { _options: options || {}, _mounted: [], _created: {} };
-        group.create = function (type) { var e = element(type, group); group._created[type] = e; return e; };
-        group.getElement = function (type) { return group._created[typeof type === "string" ? type : "card"] || null; };
-        group.update = function (next) { group._options = Object.assign({}, group._options, next || {}); };
-        group.fetchUpdates = function () { return Promise.resolve({}); };
-        group.submit = function () {
-          var card = cardOf(group);
-          if (!card || !card.number || !card.exp_month || !card.cvc) return Promise.resolve({ error: { type: "validation_error", message: "Your card details are incomplete." } });
-          return Promise.resolve({});
-        };
-        return group;
-      },
-      confirmPayment: function (options) { return confirm("payment", options); },
-      confirmSetup: function (options) { return confirm("setup", options); },
       redirectToCheckout: function (options) {
         if (!options || typeof options.sessionId !== "string" || !options.sessionId) return gap("redirectToCheckout without a sessionId")();
         window.location.assign("https://checkout.stripe.com/c/pay/" + encodeURIComponent(options.sessionId));
         return new Promise(function () {});
-      },
-      collectFinancialConnectionsAccounts: function (options) {
-        if (!options || typeof options.clientSecret !== "string" || !options.clientSecret) return gap("collectFinancialConnectionsAccounts without a clientSecret")();
-        window.location.assign("https://js.stripe.com/v3/financial-connections/" + encodeURIComponent(options.clientSecret));
-        return new Promise(function () {});
       }
     };
     return new Proxy(known, {

package/dist/src/semantics/account.d.ts

@@ -0,0 +1,2 @@
+import type { HandlerContext } from '@volter/world-core';
+export declare function GetAccount(ctx: HandlerContext): Promise<Response>;

package/dist/src/semantics/account.js

@@ -0,0 +1,8 @@
+import { PLATFORM_ACCOUNT_ID } from "../engine/stripe.js";
+import { actingAccount, accountMissing } from "./shared.js";
+// source: spec:GetAccount "Retrieves the details of an account."
+export async function GetAccount(ctx) {
+    const id = actingAccount(ctx) ?? PLATFORM_ACCOUNT_ID;
+    const account = ctx.get('account', id);
+    return account ? ctx.reply(ctx.expand('account', account)) : accountMissing(ctx, id);
+}

package/dist/src/semantics/accounts.js

@@ -27,7 +27,7 @@ export async function PostAccounts(ctx) {
         tos_acceptance: { date: null, ip: null, user_agent: null },
     });
     await connectReview(ctx, String(made.id));
-    return ctx.reply(ctx.get('account', String(made.id)));
+    return ctx.reply(ctx.expand('account', ctx.get('account', String(made.id))));
 }
 // a single-use Express dashboard link, not stored
 export async function PostAccountsAccountLoginLinks(ctx) {
@@ -36,3 +36,5 @@ export async function PostAccountsAccountLoginLinks(ctx) {
         return accountMissing(ctx, id);
     return ctx.reply({ object: 'login_link', created: nowUnix(ctx.occurredAt), url: `https://connect.twin.local/express/${id}` });
 }
+// source: spec:PostAccountsAccount "left unchanged."
+// source: https://docs.stripe.com/connect/account-capabilities "If a connected account has both card_payments and transfers"

package/dist/src/semantics/around.js

@@ -1,16 +1,13 @@
-import { actingAsOAuthKey, platformKeyRefused, publishableKeyRefused, refuseParameters, rendered, revokedAccountRefused, withMetadata } from "./shared.js";
+import { platformKeyRefused, publishableKeyRefused, refuseParameters, rendered, withMetadata } from "./shared.js";
 export async function around(ctx, next) {
     const arrived = ctx.call.request;
     const unkeyed = platformKeyRefused(ctx, arrived);
     if (unkeyed)
         return unkeyed;
-    const acting = await actingAsOAuthKey(ctx, arrived.clone());
-    if (acting instanceof Response)
-        return acting;
     if (ctx.call.operation.id !== 'unmatched') {
-        const refused = publishableKeyRefused(ctx) ?? revokedAccountRefused(ctx) ?? refuseParameters(ctx);
+        const refused = publishableKeyRefused(ctx) ?? refuseParameters(ctx);
         if (refused)
             return refused;
     }
-    return rendered(arrived, await next(withMetadata(ctx, acting)));
+    return rendered(arrived, await next(withMetadata(ctx, arrived.clone())));
 }

package/dist/src/semantics/billing_portal.d.ts

@@ -1,5 +1,4 @@
 import type { HandlerContext } from '@volter/world-core';
 export declare function GetBillingPortalConfigurations(ctx: HandlerContext): Promise<Response>;
 export declare function PostBillingPortalConfigurations(ctx: HandlerContext): Promise<Response>;
-export declare function PostBillingPortalConfigurationsConfiguration(ctx: HandlerContext): Promise<Response>;
 export declare function PostBillingPortalSessions(ctx: HandlerContext): Promise<Response>;

package/dist/src/semantics/billing_portal.js

@@ -1,6 +1,6 @@
 import { filled, PBC, PORTAL_FEATURES } from "../engine/files.js";
 import { asBool, nowUnix } from "../engine/stripe.js";
-import { actingAccount, at, created, fail, list, mergeUpdate, newest, where } from "./shared.js";
+import { actingAccount, created, fail, list, newest, where } from "./shared.js";
 export async function GetBillingPortalConfigurations(ctx) {
     return list(ctx, PBC, where(ctx, newest(ctx, PBC), {
         active: (c, v) => asBool(c.active) === asBool(v),
@@ -15,12 +15,6 @@ export async function PostBillingPortalConfigurations(ctx) {
         updated: nowUnix(ctx.occurredAt),
     }));
 }
-export async function PostBillingPortalConfigurationsConfiguration(ctx) {
-    const id = at(ctx, 'configuration');
-    if (!ctx.get(PBC, id))
-        return ctx.notFound(PBC, id);
-    return ctx.reply(await ctx.write(PBC, id, mergeUpdate(ctx, PBC, id, { ...ctx.params, updated: nowUnix(ctx.occurredAt) }), 'billing_portal.configuration.update'));
-}
 // ── the customer portal ──
 // the configuration defaults to the account's default one
 export async function PostBillingPortalSessions(ctx) {

package/dist/src/semantics/checkout.d.ts

@@ -1,3 +1,3 @@
 import type { HandlerContext } from '@volter/world-core';
+export declare function GetCheckoutSessionsSessionLineItems(ctx: HandlerContext): Promise<Response>;
 export declare function PostCheckoutSessions(ctx: HandlerContext): Promise<Response>;
-export declare function PostCheckoutSessionsSessionExpire(ctx: HandlerContext): Promise<Response>;